Paraguay

Article 1 states the object of the law as the integral protection of the personal data of natural persons, guaranteeing the full exercise of their rights and the free flow of information. Article 2 applies the law to any automated or non-automated processing of personal data forming part of a file, by natural or legal persons, and Chapter V of Title II extends its rules into the public sector as well as the private one.

Article 5 requires at least one lawful basis, such as the data subject's consent or a legal obligation, before personal data may be processed, and article 6 requires that consent be prior, free, informed and unambiguous.

Article 3 defines personal data sensibles to include racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a person, and article 20 prohibits processing sensitive data except on narrow grounds such as the data subject's own consent or a case where the person has manifestly made the data public.

Article 17 requires the controller to notify the Control Authority, and the data subject where applicable, of a security incident within 72 hours of becoming aware of it. Article 19 permits an international transfer of personal data only where the destination country, territory or organization offers an adequate level of protection as the Agency determines, or where the controller adopts appropriate safeguards such as standard contractual clauses, binding corporate rules or a code of conduct.

Articles 26 through 33 give a data subject rights of access, rectification, deletion, objection, portability and a right to contest an automated or semi-automated decision.

Article 34 creates the National Personal Data Protection Agency as an independent supervisory authority within the Ministry of Information and Communication Technologies, and article 41 lets a data subject seek judicial compensation for damages from a violation of their data-protection rights, alongside the constitutional habeas data action.

Article 46 sets administrative fines from 20 up to 2,500 minimum daily wages, rising to 5,000 for infractions involving sensitive data and to 10,000 for infractions involving the sensitive data of children or adolescents, none of which are stated as a fixed currency amount. Article 57 provides that the law enters into force twenty-four months after its official publication, and the law was promulgated and published on 27 November 2025.

Article 1 states the object of the law as guaranteeing the protection of a person's credit data and regulating the collection of, and access to, credit-information data, as well as the constitution, organization, operation, rights, obligations and dissolution of the legal persons dedicated to that activity; State agencies and pension-fund administrators count among the sources of credit-relevant information the law reaches.

The law's own definition of sensitive data mirrors the later comprehensive law's, reaching racial or ethnic origin, religious belief, union affiliation, political opinion, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a natural person. Article 21 assigns enforcement jointly to the Banco Central del Paraguay and the Secretaría de Defensa del Consumidor y el Usuario, each within its own competence, over the infractions the article lists.

Article 23 sets administrative sanctions rising from a warning to a fine of up to 15,000 minimum daily wages, doubled on repetition up to a ceiling of 50,000, to a suspension of data-processing operations of six months to five years or a permanent closure for sensitive-data infractions, none of which are stated as a fixed currency amount.

Article 30 repealed Ley N° 1682/2001, which had regulated privately held personal information generally, along with its amending laws, in the same act that created this credit-specific regime.

Ley N° 7593/2025 will, once it enters into force on 27 November 2027, treat this law's references to the Secretaría de Defensa del Consumidor y el Usuario as references to the new National Personal Data Protection Agency, and repeals article 4, subparagraphs a) and b) of article 3, subparagraph b) of article 20, and subparagraph x) of article 21 of this law in advance of that date.

Article 174 b punishes accessing a computer system or its components, using one's own identity or someone else's, or exceeding an authorization, with imprisonment of up to three years or a fine, and defines a computer system broadly to reach any device or interconnected set of devices whose function is data processing by a computer program. The provision's text does not require circumventing a security measure, unlike article 146 b below.

Article 146 b, narrower, punishes obtaining access to data that is specially protected against unauthorized access, without authorization and by violating a security system, also with imprisonment of up to three years or a fine, so ordinary access to unprotected, publicly available data falls outside its plain terms.

The same Ley N° 4439/2011 also introduced article 175, renaming and widening the pre-existing sabotage offence into sabotage of computer systems, punishing obstruction of a data-processing operation by an article 174-type act or by destroying, disabling, removing or altering processing infrastructure, with imprisonment of up to five years or a fine, and article 175 b, which conditions prosecution of articles 174 and 175 on the victim's complaint except where the public interest requires prosecution ex officio.

Article 8 excludes several categories from copyright protection outright: ideas, official legislative, administrative or judicial texts, the news of the day, and mere facts or data. Article 40 permits quoting a lawfully disclosed work without the author's authorization or payment, on condition that the author's name and the source are indicated and the quotation conforms to fair practice and is justified by its purpose.

Article 41 separately permits, without authorization or payment and subject to naming the author and the source, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder, and article 45 requires every exception in this chapter to be interpreted restrictively and never applied contrary to fair practice.

No text-and-data-mining exception, machine-readable or otherwise, has been enacted in Paraguay, so scraping a copyrighted text for model training rests only on articles 40 and 41's general exceptions, both narrower than a text and data mining (TDM) carve-out and both defeated by an express reservation.

Article 4, numeral 14 lists collections of works, such as encyclopedias and anthologies, and of other elements, such as a database, among the works copyright protects, but only where the collection is original by reason of the selection, coordination or arrangement of its contents; the enumeration is stated to be illustrative rather than exhaustive.

Paraguay confers no separate sui generis database right of the kind some other jurisdictions register: a database that is merely an unoriginal aggregation of data is not protected at all, and one that is original is protected as a compilation under ordinary copyright, not under a distinct right. Article 44's exception for personal copying does not extend to a database or compilation of data, so even a use that would otherwise be personal copying does not reach a protected database.

Article 8 excludes the news of the day and mere facts or data from copyright protection outright, alongside ideas and official legislative, administrative or judicial texts: a bare fact, or the news of the day as such, is never a protected work under Paraguayan law, whichever outlet reports it first.

Article 41 separately permits, without the author's authorization or payment, and provided the author's name and source are clearly credited, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry, but article 45 requires it to be interpreted restrictively and never applied contrary to fair practice.